Internet security: Researchers break W3C standard

Date:

October 19, 2011

Source:

Ruhr-Universitaet-Bochum

Summary:

Standards are supposed to guarantee security, especially in the WWW. The World Wide Web Consortium (W3C) is the main force behind standards like HTML, XML, and XML Encryption. But implementing a W3C standard does not mean that a system is secure. Researchers from the chair of network and data security have found a serious attack against XML Encryption. "Everything is insecure", is the uncomfortable message from the researchers.

Share:

Total shares:

FULL STORY

Standards are supposed to guarantee security, especially in the WWW. The World Wide Web Consortium (W3C) is the main force behind standards like HTML, XML, and XML Encryption. But implementing a W3C standard does not mean that a system is secure. Researchers from the chair of network and data security have found a serious attack against XML Encryption. "Everything is insecure," is the uncomfortable message from Bochum.

Standard for large integration projects

XML stands for "eXtensible Markup Language," and is the industry standard for platform-independent data exchange. Companies like IBM, Microsoft and Redhat Linux use XML standards for integrating Webservice projects for large customers. XML Encryption was designed to protect the confidentiality of the exchanged data. Reason enough to have a closer look at its security.

Weak chaining of ciphertext blocks

Juraj Somorovsky and Tibor Jager exploited a weakness in the CBC mode for the chaining of different ciphertext blocks. "We were able to decrypt data by sending modified ciphertexts to the server, by gathering information from the received error messages." The attack was tested against a popular open source implementation of XML Encrytion, and against the implementations of companies that responded to the responsible disclosure -- in all cases the result was the same: the attack works, XML Encryption is not secure.

„There is no simple patch for this problem," states Somorovsky. "We therefore propose to change the standard as soon as possible." The researchers informed all possibly affected companies through the mailing list of W3C, following a clear responsible disclosure process. With some companies there were intensive discussions on workarounds.

July 30, 2015  It is possible to predict the timing and intensity of influenza outbreaks in subtropical climates like Hong Kong where flu seasons can occur at different times and more than once during a year, ... read more

July 30, 2015  A new automated data mining system could lead to a dramatic increase in the detection of potentially illegal online sales of elephant ivory through eBay. Law enforcement agencies and conservationist ... read more

July 28, 2015  Researchers explain how the new paradigm of a digital healthcare system, as it matures, is putting the picture of the doctor-patient relationship in an entirely new frame and not always in a positive ... read more

June 13, 2014  By now, most people feel comfortable conducting financial transactions on the Web. The cryptographic schemes that protect online banking and credit card purchases have proven their reliability over ... read more

Mar. 20, 2014  There are various ways to protect a wireless network. Some are generally considered to be more secure than others. Some, such as WEP (Wired Equivalent Privacy), were broken several years ago and are ... read more

Dec. 5, 2012  How unsafe are mobile browsers? Unsafe enough that even cyber-security experts are unable to detect when their smartphone browsers have landed on potentially dangerous websites, according to a recent ... read more